- Penalty enforcement is active for Phase 1, 2 and 3 companies. Their transition periods closed on 31 January 2025, 30 June 2025 and 31 December 2025 respectively [LHDN e-Invoice Specific Guideline v4.8, Table 16.1].
- Failure to issue an e-invoice carries RM200 to RM20,000 per transaction under Section 82C(1) of the Income Tax Act 1967, read with Paragraph 120(1)(d). Because the penalty is per invoice, a high-count, low-value storefront channel produces disproportionate exposure.
- The LHDN e-Invoice Compliance Review Framework took effect on 15 December 2025 and can cover up to two assessment years, with a prosecution window of twelve years under Subsection 121(1) of the Income Tax Act 1967.
- Any single transaction exceeding RM10,000 must be issued as an individual e-invoice and cannot be consolidated. This applies to all businesses, on every channel, regardless of implementation phase.
- WooCommerce does not capture buyer Tax Identification Number (TIN), Business Registration Number (BRN) or SST registration fields at checkout by default. Adding them is a one-time change, but until it is made every storefront order defaults into the consolidated pool.
- Integration access is not a premium tier. WooCommerce and Shopify connectors are both available on the JomeInvoice Basic Plan and above.
If your company is in Phase 1, 2 or 3, your e-invoicing decision was made 12 to 24 months ago and it was almost certainly made inside your ERP. That decision covered your invoiced B2B revenue. It frequently did not cover the WooCommerce storefront your marketing team runs, because that channel does not raise a sales order in the ERP until reconciliation: sometimes days later, sometimes at month-end, sometimes not at all.
That is the gap. It is not a compliance-awareness problem; it is an architecture problem, and it sits in the one channel where transaction counts are highest and per-transaction values are lowest. This article quantifies the exposure at current enforcement levels, sets out the four routes to close it, and gives you a six-point checklist to evaluate them.
Why the Storefront Is the Weakest Link in an Enterprise Compliance Estate
An enterprise e-invoice estate usually has three layers: the ERP issuing B2B invoices, an accounting system closing the books, and a set of peripheral sales channels. The first two were scoped during the original Phase 1 to 3 implementation. The third often was not.
WooCommerce concentrates the risk because it is self-hosted. Unlike a hosted platform with a fixed data contract, a WordPress storefront accumulates plugins, custom checkout logic and theme-level overrides that change what an order record contains. The compliance layer has to accommodate whatever the store actually emits, not whatever it emitted at go-live.
Three failure patterns recur in Malaysian enterprise estates:
- Timing mismatch. Orders reach the ERP after reconciliation: end of day at best, month-end at worst. An e-invoice is a transaction-time obligation, so anything routed through the accounting cycle is structurally late.
- Field loss in transit. The middleware or connector receives an order total rather than itemised lines. LHDN requires individual line items, unit prices, quantities and tax classification codes per item, with shipping and vouchers as separate lines.
- Silent consolidation. With no buyer TIN captured at checkout, every order, including genuine B2B orders from companies that will later request a formal e-invoice, falls into the monthly consolidated pool by default.
The third pattern is the one that survives an internal audit and fails an external one, because the books balance. Consolidation is legitimate for business-to-consumer sales. It is not legitimate for a business buyer who requested an individual e-invoice, and it is never legitimate above RM10,000.
What the Exposure Actually Costs
The penalty is assessed per transaction, which inverts the usual enterprise intuition that low-value channels carry low risk.
| Annual storefront orders | Exposure at RM200 floor | Exposure at RM20,000 ceiling |
|---|---|---|
| 2,000 | RM400,000 | RM40,000,000 |
| 8,000 | RM1,600,000 | RM160,000,000 |
| 25,000 | RM5,000,000 | RM500,000,000 |
These are statutory ranges under Section 82C(1) of the Income Tax Act 1967 read with Paragraph 120(1)(d), not predictions. LHDN applies discretion and the compounding provisions in Section 10 of the Compliance Review Framework, so realised amounts will differ. The point of the table is the shape of the curve: a channel representing a small share of revenue can represent the largest share of per-invoice penalty exposure, purely on transaction count.
Two further clocks apply. A compliance review can cover up to two assessment years, so a gap opened in 2026 remains in scope through 2027 and beyond. Prosecution runs to twelve years under Subsection 121(1). Record retention is seven years as a statutory floor under Section 82 of the Income Tax Act 1967, which is a minimum rather than a target. See our LHDN e-invoice penalty guide for the full penalty structure.
Is your WooCommerce channel inside your compliance estate?
Integrate with SAP, Oracle, Dynamics 365 and more.
Local support from Malaysia.
The Four Routes From WooCommerce to MyInvois
These four options are mutually exclusive and cover the field. The right answer depends on where your reconciliation currently breaks, not on which vendor you already use.
| Route | How it works | Best for | Risk if ignored |
|---|---|---|---|
| MyInvois portal, manual | Finance keys each order into LHDN’s portal by hand | Pilot or wind-down channels only | Does not scale past low volumes; no buyer-request handling |
| ERP-native module | Storefront orders sync to the ERP, which issues the e-invoice | Enterprises whose storefront already posts to the ERP in real time | Timing gap when posting is batched; localisation lag on global ERP vendors |
| Custom API build | In-house team integrates WooCommerce directly to the MyInvois API | Enterprises with dedicated developers and an existing integration platform | Ongoing maintenance as LHDN specifications change; delivery risk against enforcement dates |
| Middleware layer | A compliance layer sits between the storefront and MyInvois | Enterprises whose storefront sits outside the ERP transaction flow | Vendor dependency; requires diligence on the provider’s update cadence |
The integration models guide covers the architectural trade-offs in more depth, and MyInvois versus API integration versus middleware compares the three automated routes head to head.
The route to choose is the one that matches where your data actually lives. If WooCommerce already posts orders to your ERP at transaction time with full line detail, extend the ERP module rather than adding a layer. If it does not, no amount of ERP configuration will fix a source-system timing problem.
Where ERP-Led and Accounting-Led Approaches Break
Both are legitimate architectures. Both have a specific failure mode on storefront traffic that is worth naming before you commit.
ERP-native modules are built around the sales order, not the web order. Where the storefront posts to the ERP on a batch schedule, the e-invoice inherits the batch timing. Global ERP vendors also deprioritise Malaysian localisation relative to larger markets, so each LHDN specification revision becomes an internal change request with its own cost and lead time. Enterprises running SAP, Oracle or Microsoft Dynamics should scope who absorbs that cost before assuming the module covers the channel.
Accounting-software modules such as SQL Account and AutoCount are built around the chart of accounts. They see a reconciled transaction, which by definition is a transaction that has already been closed. That is the correct place to record revenue and the wrong place to originate a real-time compliance document.
Neither observation argues for replacing those systems. It argues for being precise about which layer owns the obligation for which channel, and documenting that decision so it survives a compliance review. QuickBooks users should note that JomeInvoice connects to QuickBooks directly rather than competing with it.
How JomeInvoice Connects WooCommerce
JomeInvoice sits between the storefront and LHDN MyInvois and leaves your ERP untouched. The connection runs through the Integration Module in your workspace, and it is available on the Basic Plan and above rather than being gated to a premium tier.
Orders synchronise automatically once an order is marked Completed in WooCommerce, and the WooCommerce order number maps to the invoice number in JomeInvoice. Validation runs before anything reaches MyInvois: TIN format, tax classification codes, tax rates and unit-of-measure values are all checked, and failures are flagged for correction rather than returned as an Invalid status after submission.
Buyer requests are handled without manual matching. The order-completion email carries a Request e-Invoice link; the form pre-fills receipt number, date and amount from the original order, the buyer supplies their tax details and uploads their receipt, and JomeInvoice verifies the submission against the order record. Approved requests convert the invoice from consolidated to non-consolidated and the validated e-invoice reaches the buyer the following morning. Rejections, whether receipt number, amount or date mismatch, are visible under Sales, Requests, with a stated reason so the buyer can resubmit.
For stores with custom checkout structures or non-standard exports, CSV upload with field mapping is available as a parallel route. You map the columns once and the mapping applies to every subsequent upload. SFTP and API submission use the same validated field structure across all channels.
Multi-channel estates run under one workspace. If you also operate physical outlets or a second storefront, those channels sit in the same compliance view rather than in separate silos.
Post-Validation Adjustments
Once LHDN validates an invoice it cannot be edited or deleted. Editing the underlying WooCommerce order changes your records and not LHDN’s, which is precisely the divergence a compliance review looks for.
| Document | Effect on the original | Typical trigger |
|---|---|---|
| Credit Note | Reduces the amount | Returns, overbilling corrections |
| Debit Note | Increases the amount | Underbilling, additional charges |
| Refund Note | Documents payment returned to the buyer | Refunded orders |
Cancellation is available within 72 hours of validation. Beyond that window, only an adjustment document can modify the record, and there is no time limit on issuing one. Note that JomeInvoice does not support cancelling invoices from the WooCommerce flow. Refund notes are the supported path. In practice a WooCommerce refund set to Refunded status generates a linked Refund Note automatically. Our guide on how to amend or cancel an e-invoice covers the full sequence.
A Six-Point Evaluation Checklist
Apply this to any route, including ours.
- Confirm the trigger point. At what event does an e-invoice originate: order completion, payment capture, or ERP posting? Anything downstream of reconciliation is structurally late.
- Test line-level fidelity. Submit a live order containing a discount, a voucher and shipping. Confirm all three arrive as separate lines with correct tax classification codes.
- Force a validation failure. Submit a malformed TIN deliberately. A route that returns an actionable pre-submission error is materially different from one that surfaces an LHDN Invalid status after the fact.
- Exercise the buyer-request path. Have a test buyer request an individual e-invoice, then confirm the transaction leaves the consolidated pool and the audit trail shows the conversion.
- Verify the RM10,000 routing. Place a test order above the threshold and confirm it is excluded from consolidation automatically rather than by manual review.
- Ask who absorbs specification changes. LHDN has revised its guidelines repeatedly. Establish in writing whether an update is vendor-side or a billable change request against your team.
Points 3 and 6 separate credible options from the rest, and they are the two most often skipped in enterprise procurement.
Sources and Further Reading
- LHDN e-Invoice guidelines, the official guideline library, including Specific Guideline v4.8
- LHDN e-Invoice implementation timeline, phase dates by revenue band
- MyInvois portal, LHDN’s validation platform
- LHDN e-Invoice frequently asked questions, the official FAQ set
- Consolidated e-invoice rules explained
- e-Invoicing for eCommerce in Malaysia
- Enterprise e-invoicing solutions
Disclaimer: This article is for general informational purposes only and does not constitute legal or tax advice. LHDN guidelines are subject to updates. Always refer to the latest official LHDN e-Invoice Guidelines at myinvois.hasil.gov.my and consult a qualified tax professional for advice specific to your business.
Last updated: 19 August 2026
The storefront gap is an architecture decision, not a compliance question
Your enterprise already knows the rules. What it may not have is a documented answer to which layer owns the e-invoice obligation for direct-to-consumer orders, and evidence that the answer holds at transaction time rather than at month-end. Establish the trigger point, test the four checkpoints above against a live order, and record the decision. A compliance review under the December 2025 framework will ask for exactly that.
See your WooCommerce orders reach LHDN before you commit
Integrate with SAP, Oracle, Dynamics 365 and more.
Local support from Malaysia.
Disclaimer: This article is for general informational purposes only and does not constitute legal or tax advice. LHDN guidelines are subject to updates. Always refer to the latest official LHDN e-Invoice Guidelines at myinvois.hasil.gov.my and consult a qualified tax professional for advice specific to your business.
Frequently Asked Questions
Does WooCommerce support LHDN e-invoicing natively?
No. WooCommerce has no native MyInvois integration and does not capture buyer TIN, BRN or SST registration fields at checkout by default. Those fields require a checkout field editor plugin or a code change, and submission to LHDN requires a portal, ERP module, custom API build or middleware layer.
Is penalty enforcement active for our phase today?
Yes. Enforcement is live for Phase 1, 2 and 3 companies. Failure to issue an e-invoice carries RM200 to RM20,000 per transaction under Section 82C(1) of the Income Tax Act 1967, read with Paragraph 120(1)(d).
Can a WooCommerce order above RM10,000 be consolidated?
No. Any single transaction exceeding RM10,000 must be issued as an individual e-invoice. This applies to all businesses without exception, and it holds regardless of whether the buyer requests one.
Which JomeInvoice plan includes the WooCommerce integration?
The Basic Plan and above. Integration access is not restricted to the Pro Plan. The difference between tiers is consolidation-request volume and storage. Confirm current plan details at [jomeinvoice.my/pricing](https://jomeinvoice.my/pricing/).
Do we need to replace our ERP to close the storefront gap?
No. A middleware layer connects the storefront to MyInvois independently of the ERP, which continues to issue e-invoices for the channels it already covers. Validated records can feed back into the ERP or accounting system for reconciliation.
How far back can an LHDN compliance review look at our e-invoice records?
Up to two assessment years under Section 4 of the e-Invoice Compliance Review Framework, effective 15 December 2025. Prosecution can be brought up to twelve years from the year the offence occurred under Subsection 121(1) of the Income Tax Act 1967.
What happens to storefront orders where the buyer never requests an e-invoice?
They remain in the monthly consolidated pool and are submitted to LHDN in one consolidated e-invoice within seven calendar days after month-end, using the general public TIN EI00000000010. Buyers who request an individual e-invoice within the transaction month are excluded from that consolidation automatically.
Last updated: 19 August 2026 | Written by Yinn Sheng Ng, Head of Marketing